Communication method and device of vehicle-mounted network, electronic equipment and storage medium
By authenticating the physical characteristics of current network equipment in the on-board network, the problem of difficult application of communication security measures in traditional CAN networks is solved, and the effect of improving on-board network security without affecting communication efficiency is achieved.
Patent Information
- Application Number
- CN202411542656.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-31
- Publication Date
- 2025-03-07
AI Technical Summary
Existing in-vehicle network communication security measures are difficult to apply in traditional CAN networks, and the identity authentication method based on key exchange and certificate verification is expensive and difficult to widely apply.
By collecting the physical characteristics of the current network device and performing communication authentication based on the authorized physical characteristics of the target vehicle network, it is determined whether the device is qualified to establish communication with the vehicle network, thereby determining whether access is allowed.
Effectively prevent the access of fake ECUs and illegal equipment, improve the security of on-board network communication, reduce implementation costs, and do not affect the efficiency of traditional CAN communication.
Smart Images
Figure CN119583106A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of vehicle-mounted network communication technology, and in particular to a vehicle-mounted network communication method, device, electronic device and storage medium. Background Art
[0002] As automotive electronic systems become increasingly complex, the various electronic control units (ECUs) inside the vehicle need to frequently exchange information to achieve various functions, such as engine control, braking system, entertainment system, etc. However, this also makes the vehicle network a target for attackers, especially the vehicle CAN (Controller Area Network), CANFD (Controller Area Network with Flexible Data-Rate) and vehicle Ethernet. These network systems are the core of modern car internal communications and are responsible for coordinating data exchanges between various ECUs. Attackers often use special tools to access the vehicle network to carry out various network attacks, such as replay attacks, denial of service (DoS) attacks, data tampering, etc., and even conduct more complex attack activities by accessing fake ECUs. These attacks may cause damage to vehicle functions, data leakage, or even vehicle loss of control, seriously threatening driving safety.
[0003] The main protection measures against such attacks currently include the SecOC (Secure On-board Communication) solution, which is a security solution designed specifically for CAN FD communication, aiming to protect the security of vehicle network communications through encryption and authentication mechanisms. The SecOC solution implements data encryption and authentication by adding additional security fields to CAN messages, thereby preventing data from being tampered with or forged. However, a major disadvantage of the SecOC solution is that it occupies more CAN message space, which is not friendly to traditional CAN communications (up to 8 bytes of data field) because it adds additional load, thereby affecting communication efficiency. Therefore, although the SecOC solution performs well in CAN FD communications, it is difficult to be widely used in traditional CAN networks.
[0004] Another common means of protection is to prevent access to counterfeit ECUs through identity authentication. This method usually includes the use of technologies such as public key infrastructure (PKI), digital certificates, and key exchange protocols to verify the identity of the device. In this way, only authenticated devices can access the vehicle network and communicate. However, the implementation of this identity authentication method requires a large cost investment, including hardware costs, software development costs, and maintenance costs. Therefore, although this method provides higher security in theory, it is constrained by cost in practical applications, and currently few manufacturers on the market actually adopt this method.
[0005] Due to the above limitations of existing protection measures, the attack threats currently faced by vehicle networks are still widespread. Summary of the invention
[0006] In order to solve the problems of the prior art, the embodiments of the present application provide a communication method, device, electronic device and storage medium for an in-vehicle network. The technical solution is as follows:
[0007] In one aspect, a communication method of an in-vehicle network is provided, the method comprising:
[0008] In response to a communication request of a current network device to a target vehicle network, collecting a physical characteristic of the current network device;
[0009] Based on the current configuration state of the target vehicle network and the current network device, determining whether the communication request meets a preset communication authentication condition;
[0010] In the case where the communication request meets the preset communication authentication condition, based on the authorized physical characteristics corresponding to the target vehicle network, the physical characteristics of the current network device are subjected to communication authentication to obtain an authentication result; the authentication result indicates whether the current network device is qualified to establish communication with the target vehicle network;
[0011] The communication request is processed based on the authentication result.
[0012] On the other hand, a communication device for a vehicle network is provided, the device comprising:
[0013] A feature collection module, configured to collect physical features of the current network device in response to a communication request of the current network device for the target vehicle network;
[0014] An authentication condition module, used to determine whether the communication request meets a preset communication authentication condition based on the current configuration state of the target vehicle network and the current network device;
[0015] a communication authentication module, configured to perform communication authentication on the physical characteristics of the current network device based on the authorized physical characteristics corresponding to the target vehicle network, and obtain an authentication result when the communication request meets the preset communication authentication condition; the authentication result indicates whether the current network device is qualified to establish communication with the target vehicle network;
[0016] A communication processing module is used to process the communication request based on the authentication result.
[0017] In an exemplary embodiment, the authentication condition module includes:
[0018] A configuration acquisition module, used to acquire the current configuration status of the target vehicle network;
[0019] A condition judgment module, used to judge whether the current network device meets the authentication-free condition when the current configuration state indicates that the target vehicle network has enabled the communication authentication mechanism;
[0020] The condition compliance module is used to determine that the communication request meets the preset communication authentication condition when the current network device does not meet the authentication-free condition.
[0021] In an exemplary embodiment, the apparatus further includes a configuration update module for actively collecting physical characteristics of the current network device in the initial configuration state and enabling a communication authentication mechanism of the target vehicle network, the configuration update module including:
[0022] An initial configuration module, used to determine whether the current configuration state is an initial configuration state; the initial configuration state indicates that the target vehicle network closes the communication authentication mechanism;
[0023] A first communication establishing module, configured to establish a communication connection between the current network device and the target vehicle network when the current configuration state is the initial configuration state;
[0024] a feature adding module, configured to add the physical features of the current network device to the authorized physical features if the physical features of the current network device do not exist in the authorized physical features;
[0025] The authentication activation module is used to activate the communication authentication mechanism of the target vehicle network and update the current configuration state.
[0026] In an exemplary embodiment, the apparatus further includes a second communication establishment module for establishing a communication connection between the authentication-free network device and the target vehicle network, wherein the second communication establishment module includes:
[0027] The second communication establishing module is used to establish a communication connection between the current network device and the target vehicle network when the current network device meets the authentication-free condition.
[0028] In an exemplary embodiment, the feature acquisition module includes:
[0029] A request construction module, used for constructing a parameter request frame for a target parameter;
[0030] A parameter request module, configured to send the parameter request frame to the current network device, so that the current network device returns a response frame corresponding to the parameter request frame;
[0031] A response parsing module, used for parsing the response frame to obtain the target parameters;
[0032] The hash calculation module is used to calculate the hash value based on the target parameter to obtain the physical characteristics of the current network device.
[0033] In an exemplary embodiment, the communication processing module includes:
[0034] a communication rejection module, configured to reject the communication request if the authentication result indicates that the current network device is not qualified to establish communication with the target vehicle network;
[0035] The security alarm module is used to send alarm information to the network security node of the target vehicle network so that the network security node processes the alarm information.
[0036] On the other hand, an electronic device is provided, including a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the communication method of the vehicle network of any of the above aspects.
[0037] On the other hand, a computer-readable storage medium is provided, in which at least one instruction or at least one program is stored, and the at least one instruction or the at least one program is loaded and executed by a processor to implement a communication method of an in-vehicle network as described in any of the above aspects.
[0038] On the other hand, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the electronic device executes the communication method of the vehicle network of any one of the above aspects.
[0039] The embodiment of the present application performs communication authentication on the physical characteristics of the current network device based on the authorized physical characteristics corresponding to the target vehicle network when the communication request meets the preset communication authentication conditions to verify the legitimacy of the current network device, thereby effectively preventing the access of counterfeit ECUs and other illegal devices, ensuring that only authenticated legal devices can communicate with the vehicle network, curbing the threat of the vehicle network from the source of the attack, significantly improving the security of the vehicle network communication, and preventing damage to vehicle functions or data leakage caused by malicious attacks. In addition, the authentication can be completed by only collecting and comparing the authorized physical characteristics corresponding to the target vehicle network, which will not occupy too much CAN message space like the SecOC solution, thereby not affecting the efficiency of traditional CAN communication, and thus providing security protection without affecting the existing communication performance. Compared with the traditional identity authentication method based on key exchange and certificate verification, the present application reduces the requirements for hardware and software support, reduces the implementation cost, and also reduces the cost of subsequent maintenance. BRIEF DESCRIPTION OF THE DRAWINGS
[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0041] Figure 1 It is a flow chart of a communication method of an in-vehicle network provided in an embodiment of the present application;
[0042] Figure 2 It is a structural block diagram of the vehicle-mounted CAN network provided in an embodiment of the present application;
[0043] Figure 3 It is a structural block diagram of the vehicle Ethernet provided by the embodiment of the present application;
[0044] Figure 4 It is a flowchart of another vehicle network communication method provided by an embodiment of the present application;
[0045] Figure 5 It is a structural block diagram of a communication device of an in-vehicle network provided in an embodiment of the present application;
[0046] Figure 6 It is a hardware structure block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0047] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.
[0048] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0049] It is understandable that in the specific implementation of this application, related data such as user information is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.
[0050] See also Figure 1 , which shows a flow chart of a vehicle network communication method provided in an embodiment of the present application. It should be noted that this specification provides method operation steps such as the embodiments or flow charts, but may include more or fewer operation steps based on conventional or non-creative labor. The order of steps listed in the embodiments is only one way of executing the steps among many orders, and does not represent the only order of execution. When the actual system or product is executed, it can be executed in the order shown in the embodiments or the drawings or in parallel (for example, in a parallel processor or multi-threaded processing environment). Specifically, Figure 1 As shown, the method may include:
[0051] S101, in response to a communication request of a current network device for a target vehicle network, collecting physical characteristics of the current network device.
[0052] Among them, the current network device refers to the device that is trying to establish a communication connection with the target vehicle network. At this time, the current network device has not passed any authentication process and its legitimacy has not been verified.
[0053] Specifically, current network devices can be connected to the vehicle network through the following methods: physical interface, such as OBD-II (On-Board Diagnostics II, second generation of vehicle diagnostic system) port, USB (Universal Serial Bus) interface, etc.; wireless interface, such as Bluetooth, Wi-Fi (wireless network communication technology), etc.; vehicle Ethernet interface, an interface for high-speed data transmission.
[0054] In specific implementations, the current network devices can be various types of devices, mainly including but not limited to: various control units inside the vehicle, such as the engine control unit, brake control unit, etc.; professional tools for diagnosing and repairing vehicles; other external devices, such as smart phones, tablets, etc.; tools or fake ECUs used by attackers to launch attacks.
[0055] Specifically, the purpose of the current network device accessing the target vehicle network may include normal communication and control with the target vehicle network, launching attacks on the target vehicle network or tampering with data, and remotely monitoring or maintaining the target vehicle network.
[0056] The target vehicle network refers to the vehicle network that is currently communicating or preparing to communicate. Specifically, the structure of the target vehicle network usually includes nodes, buses, and protocols. Nodes refer to various ECUs or other devices in the network. They are communication nodes in the network. The bus is a physical communication line. All nodes share this bus for data transmission. The protocol specifies the format and rules of data transmission to ensure the consistency and reliability of communication between nodes.
[0057] Specifically, the target vehicle network can be vehicle CAN / CANFD, vehicle Ethernet. CAN is a field bus standard widely used in automobiles for communication between various ECUs inside the vehicle. CANFD is an improved version of CAN technology that supports higher data transmission rates and is suitable for application scenarios that require higher bandwidth. Figure 2 As shown in the figure, ECU1, ECU2, ECU3...ECUn and other nodes are connected to the bus through CAN_H and CAN_L. When an ECU needs to send data, it will publish a data frame on the bus, and all other ECUs connected to the bus can receive this data frame. X and Ω represent terminal resistance, which is used to absorb reflected waves at both ends of the bus, reduce signal distortion and interference, stabilize the electrical characteristics of the CAN bus, and ensure the stability of data transmission. Figure 3As shown in the figure, the in-vehicle Ethernet usually adopts a hierarchical structure for easy management and maintenance. Nodes such as ECU1, ECU2, ECU3...ECUn are connected to the gateway through Ethernet. The gateway acts as a bridge between different networks and is responsible for connecting the in-vehicle Ethernet with other networks (such as the CAN network). The physical characteristics of the current network device are collected through the target in-vehicle network.
[0058] The communication request refers to a request by the current network device to establish a communication connection with the target vehicle network. Specifically, the communication request is triggered when the current network device attempts to establish a communication connection with the target vehicle network, for example, by attempting to access the target vehicle network through a physical interface, a wireless interface, a vehicle Ethernet interface, etc.
[0059] Among them, the physical characteristics indicate the specific unique attributes of the network device, such as the physical address or serial number of the device, which can be called the fingerprint information of the device.
[0060] Specifically, a parameter request frame for a target parameter is constructed; a parameter request frame is sent to the current network device so that the current network device returns a response frame corresponding to the parameter request frame; the response frame is parsed to obtain the target parameter; a hash value is calculated based on the target parameter to obtain the physical characteristics of the current network device. The target parameter includes but is not limited to the MAC address (Media Access Control Address), serial number, hardware version number, firmware version, etc. of the network device. Specifically, according to the network protocol supported by the device, such as SNMP (Simple Network Management Protocol), HTTP (Hypertext Transfer Protocol), SSH (Secure Shell), etc., a suitable protocol is selected to construct the request frame. The request frame structure includes a frame header, a command type, a parameter identifier, a checksum, and an end flag. The frame header contains basic information such as a source address and a target address. The command type specifies the type of request, such as a GET request, which is used to obtain device information. The parameter identifier specifies the target parameter of the request, such as a serial number, a MAC address, etc. The checksum is the verification information to ensure data integrity, and the end flag is the end flag of the frame. Extract target parameters such as serial number, MAC address, etc. from the response frame, combine the target parameters according to certain rules, and use the selected hash algorithm to calculate the combined parameters to obtain the hash value, which is used as the physical feature of the device.
[0061] S103, based on the current configuration state of the target vehicle network and the current network device, determining whether the communication request meets the preset communication authentication condition.
[0062] Specifically, if the result of the judgment is yes, step S105 can be executed; otherwise, if the result of the judgment is no, step S109 can be executed.
[0063] Among them, the current configuration status indicates whether the communication authentication mechanism is turned on in the target vehicle network. Specifically, the configuration of the target vehicle network usually includes an authorized device list, communication rules, and security policies. Among them, the authorized device list stores the physical characteristics of legitimate devices, that is, authorized physical characteristics, which are used to authenticate access devices; the communication rules define the communication rules between network nodes in the network, such as which devices can communicate with each other and which devices can only receive specific types of data; the security policy sets a series of security policies, such as authentication mechanisms, data encryption, etc., to protect the network from attacks.
[0064] Among them, the preset communication authentication condition refers to a series of standards or rules pre-defined in the vehicle network, indicating a situation where communication authentication is not required.
[0065] Specifically, when the communication request meets the preset communication authentication conditions, communication authentication is performed on the physical characteristics of the current network device. When the communication request does not meet the preset communication authentication conditions, there is no need to perform communication authentication on the physical characteristics of the current network device, and a communication connection is directly established between the current network device and the target vehicle network.
[0066] In an exemplary embodiment, Figure 4 As shown, the above step S103 may include:
[0067] S401, obtaining the current configuration status of the target vehicle network.
[0068] Specifically, through the network management tool or API interface (Application Programming Interface), the current configuration information is obtained from the central management device (such as a gateway or central control unit) of the target vehicle network, the obtained configuration information is parsed, and the configuration parameters related to communication authentication, such as the communication authentication switch status, are extracted.
[0069] S403, determining whether the current configuration state indicates that the target vehicle network starts a communication authentication mechanism.
[0070] Specifically, if the result of the judgment is yes, step S405 can be executed; otherwise, if the result of the judgment is no, step S109 can be executed.
[0071] Specifically, when the communication authentication mechanism is enabled on the target vehicle network, it is necessary to further determine whether the current network device meets the authentication exemption conditions; when the communication authentication mechanism is not enabled on the target vehicle network, the current network device is allowed to access the target vehicle network.
[0072] In specific implementation, when the vehicle is started for the first time after leaving the factory, in order to ensure that the vehicle network can smoothly transition to a safe state, the communication authentication mechanism is usually turned off by default. At this time, the network devices connected to the target vehicle network are considered legitimate, and the system will actively collect the physical characteristics of these network devices and add them to the authorized physical characteristics list to check for omissions in the authorized physical characteristics.
[0073] Specifically, determine whether the current configuration state is the initial configuration state; the initial configuration state indicates that the target vehicle network closes the communication authentication mechanism; when the current configuration state is the initial configuration state, establish a communication connection between the current network device and the target vehicle network; when the physical characteristics of the current network device do not exist in the authorized physical characteristics, add the physical characteristics of the current network device to the authorized physical characteristics; enable the communication authentication mechanism of the target vehicle network and update the current configuration state. Among them, the initial configuration state means that the vehicle is started for the first time after leaving the factory, and the communication authentication mechanism is closed by default. Specifically, if the current configuration state is the initial configuration state, establish a communication connection between the current network device and the target vehicle network, because at this time all connected network devices are considered to be legal and actively collect the physical characteristics of these network devices. When the physical characteristics of the current network device do not exist in the authorized physical characteristics, use a hash algorithm (such as SHA256) to process the physical characteristics, generate a hash value, and store the generated hash value in the vehicle's secure storage area; enable the communication authentication mechanism of the target vehicle network to ensure that subsequent connected devices must pass authentication before communication can be carried out, and update the current configuration state to reflect that the communication authentication mechanism has been enabled. Common secure storage areas include TPM (Trusted Platform Module), eMMC (Embedded Multi-Media Card) security partition, and secure memory. TPM is a security chip built into the vehicle, specifically used to store sensitive information; a secure partition in eMMC is used to store critical data; and secure memory is a memory area specifically designed to store sensitive information, usually with encryption capabilities.
[0074] S405, determining whether the current network device meets the certification-free condition.
[0075] Specifically, if the result of the judgment is no, step S105 can be executed; otherwise, if the result of the judgment is yes, step S109 can be executed.
[0076] Specifically, it is determined whether the current network device meets the conditions according to the preset authentication-free conditions (such as device type, device role, communication frequency, etc.). In the specific implementation, if the device connected is a diagnostic instrument, in order not to affect the service authentication, no communication authentication is performed on it.
[0077] Specifically, when the current network device does not meet the authentication-free condition, a communication authentication process needs to be performed; when the current network device meets the authentication-free condition, a communication connection can be directly established.
[0078] It can be seen from the above technical solutions of the embodiments of the present application that the embodiments of the present application verify the current configuration status of the target vehicle network and the current network device before communication authentication, so that when the communication authentication mechanism of the target vehicle network is not enabled or the current network device meets the authentication-free conditions, the current network device is directly allowed to access the target vehicle network, thereby simplifying the access process and improving the device startup speed and user experience; when the communication authentication mechanism of the target vehicle network is enabled and the current network device does not meet the authentication-free conditions, communication authentication is performed to ensure that only verified legitimate devices can communicate, thereby improving the security and reliability of the vehicle network.
[0079] S105, based on the authorized physical characteristics corresponding to the target vehicle network, communication authentication is performed on the physical characteristics of the current network device to obtain an authentication result.
[0080] Authorized physical features refer to the physical features of devices that are allowed to communicate in the target vehicle network. These features are usually used in the identity authentication process to ensure that only legitimate devices can access the target vehicle network and exchange data. These features can be static (such as the device's serial number, MAC address, etc.) or dynamically generated (such as a hash value based on the device hardware).
[0081] In specific implementation, a lightweight physical feature trust library, also called a fingerprint library, can be set up to hash the authorized physical features and store them in a secure area of the vehicle (such as the secure partition of TPM or eMMC) to ensure that they are not easily tampered with or accessed. The physical feature trust library can be filled during the production stage or collected automatically. The production stage usually includes the equipment manufacturing stage, the vehicle assembly stage, the production test stage, etc. In specific implementation, the physical feature trust library can be flexibly configured and occupies few resources, usually less than 5KB.
[0082] The authentication result indicates whether the current network device is qualified to establish communication with the target vehicle network.
[0083] In the specific implementation, the physical characteristics of the current network device are compared with the authorized physical characteristics, that is, fingerprint matching. If the physical characteristics of the current network device exist in the authorized physical characteristics, it is considered that the current network device is qualified to establish communication with the target vehicle network. If the physical characteristics of the current network device do not exist in the authorized physical characteristics, it is considered that the current network device is not qualified to establish communication with the target vehicle network.
[0084] S107, processing the communication request based on the authentication result.
[0085] Specifically, if the authentication result indicates that the current network device is not qualified to establish communication with the target vehicle network, the communication request is rejected; an alarm message is sent to the network security node of the target vehicle network so that the network security node processes the alarm message. Specifically, the alarm message is sent to the network security node through the target vehicle network. In specific implementations, network security nodes, such as IDPS (Intrusion Detection and Prevention System) and IDS (Intrusion Detection System), usually send alarm notifications to users, which increases user experience.
[0086] Specifically, when the authentication result indicates that the current network device is qualified to establish communication with the target vehicle network, step S109 is executed.
[0087] S109, establishing a communication connection between the current network device and the target vehicle network.
[0088] Specifically, when the communication request does not meet the preset communication authentication conditions, or the physical characteristics of the current network device pass the communication authentication, that is, the authentication result indicates that the current network device is qualified to establish communication with the target vehicle network, the current network device is allowed to access the target vehicle network.
[0089] It can be seen from the above technical solutions of the embodiments of the present application that the embodiments of the present application perform communication authentication on the physical characteristics of the current network device based on the authorized physical characteristics corresponding to the target vehicle network when the communication request meets the preset communication authentication conditions to verify the legitimacy of the current network device, thereby effectively preventing the access of counterfeit ECUs and other illegal devices, ensuring that only authenticated legal devices can communicate with the vehicle network, curbing the threat of the vehicle network from the source of the attack, significantly improving the security of the vehicle network communication, and preventing damage to vehicle functions or data leakage caused by malicious attacks. In addition, the authentication can be completed by only collecting and comparing the authorized physical characteristics corresponding to the target vehicle network, which will not occupy too much CAN message space like the SecOC solution, thereby not affecting the efficiency of traditional CAN communication, and thus providing security protection without affecting the existing communication performance. Compared with the traditional identity authentication method based on key exchange and certificate verification, the present application reduces the requirements for hardware and software support, reduces the implementation cost, and also reduces the cost of subsequent maintenance.
[0090] Corresponding to the communication methods of the vehicle network provided in the above-mentioned embodiments, an embodiment of the present application also provides a communication device of the vehicle network. Since the communication device of the vehicle network provided in the embodiment of the present application corresponds to the communication methods of the vehicle network provided in the above-mentioned embodiments, the implementation methods of the aforementioned communication methods of the vehicle network are also applicable to the communication device of the vehicle network provided in this embodiment, and will not be described in detail in this embodiment.
[0091] See also Figure 5 , which is a schematic diagram of the structure of a vehicle network communication device provided by an embodiment of the present application, the device has the function of implementing the vehicle network communication method in the above method embodiment, and the function can be implemented by hardware or by hardware executing corresponding software. Figure 5 As shown, the device may include:
[0092] The feature collection module 510 is used to collect the physical features of the current network device in response to the communication request of the current network device for the target vehicle network;
[0093] The authentication condition module 520 is used to determine whether the communication request meets the preset communication authentication condition based on the current configuration state of the target vehicle network and the current network device;
[0094] The communication authentication module 530 is used to perform communication authentication on the physical characteristics of the current network device based on the authorized physical characteristics corresponding to the target vehicle network when the communication request meets the preset communication authentication conditions, and obtain an authentication result; the authentication result indicates whether the current network device is qualified to establish communication with the target vehicle network;
[0095] The communication processing module 540 is used to process the communication request based on the authentication result.
[0096] In an exemplary embodiment, the authentication condition module includes:
[0097] A configuration acquisition module is used to obtain the current configuration status of the target vehicle network;
[0098] A condition judgment module, used to judge whether the current network device meets the exemption condition when the current configuration status indicates that the target vehicle network has started the communication authentication mechanism;
[0099] The condition compliance module is used to determine whether the communication request meets the preset communication authentication condition when the current network device does not meet the authentication-free condition.
[0100] In an exemplary embodiment, the apparatus further includes a configuration update module for actively collecting physical characteristics of the current network device in the initial configuration state and enabling a communication authentication mechanism of the target vehicle network, the configuration update module including:
[0101] An initial configuration module is used to determine whether the current configuration state is an initial configuration state; the initial configuration state indicates that the target vehicle network closes the communication authentication mechanism;
[0102] A first communication establishing module, used to establish a communication connection between the current network device and the target vehicle network when the current configuration state is the initial configuration state;
[0103] A feature adding module, used for adding the physical features of the current network device to the authorized physical features if the physical features of the current network device do not exist in the authorized physical features;
[0104] The authentication start module is used to start the communication authentication mechanism of the target vehicle network and update the current configuration status.
[0105] In an exemplary embodiment, the apparatus further includes a second communication establishment module for establishing a communication connection between the authentication-free network device and the target vehicle network, the second communication establishment module including:
[0106] The second communication establishing module is used to establish a communication connection between the current network device and the target vehicle network when the current network device meets the authentication-free condition.
[0107] In an exemplary embodiment, the feature acquisition module includes:
[0108] A request construction module, used for constructing a parameter request frame for a target parameter;
[0109] A parameter request module, used to send a parameter request frame to the current network device, so that the current network device returns a response frame corresponding to the parameter request frame;
[0110] Response parsing module, used to parse the response frame and obtain the target parameters;
[0111] The hash calculation module is used to calculate the hash value based on the target parameters to obtain the physical characteristics of the current network device.
[0112] In an exemplary embodiment, the communication processing module includes:
[0113] A communication rejection module, used to reject the communication request if the authentication result indicates that the current network device is not qualified to establish communication with the target vehicle network;
[0114] The security alarm module is used to send alarm information to the network security node of the target vehicle network so that the network security node processes the alarm information.
[0115] It should be noted that the device provided in the above embodiment, when implementing its functions, is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.
[0116] An embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement any one of the vehicle network communication methods provided in the above method embodiments.
[0117] The memory can be used to store software programs and modules. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, application programs required for functions, etc.; the data storage area can store data created according to the use of the device, etc. In addition, the memory can include a high-speed random access memory and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory can also include a memory controller to provide the processor with access to the memory.
[0118] The method embodiments provided in the embodiments of the present application may be executed in a computer terminal, a server or a similar computing device, that is, the above-mentioned electronic device may include a computer terminal, a server or a similar computing device. Figure 6 is a hardware structure block diagram of a computer device for running a communication method for an in-vehicle network provided by an embodiment of the present invention, such as Figure 6 As shown, the internal structure of the computer device may include but is not limited to: a processor, a network interface and a memory. The processor, network interface and memory in the computer device may be connected via a bus or other means. Figure 6 The example of connecting through bus is taken in the following.
[0119] Among them, the processor (or CPU (Central Processing Unit)) is the computing core and control core of the computer device. The network interface may optionally include a standard wired interface, a wireless interface (such as WI-FI, a mobile communication interface, etc.). Memory is a memory device in a computer device for storing programs and data. It is understandable that the memory here can be a high-speed RAM storage device or a non-volatile memory device (non-volatile memory), such as at least one disk storage device; optionally, it can also be at least one storage device located away from the aforementioned processor. The memory provides a storage space, which stores the operating system of the electronic device, including but not limited to: Windows system (an operating system), Linux (an operating system), Android (Android, a mobile operating system) system, IOS (a mobile operating system) system, etc., and the present invention is not limited to this; and, in the storage space, one or more instructions suitable for being loaded and executed by the processor are also stored, and these instructions can be one or more computer programs (including program codes). In the embodiment of this specification, the processor loads and executes one or more instructions stored in the memory to implement the communication method of the vehicle network provided in the above method embodiment.
[0120] An embodiment of the present application also provides a computer-readable storage medium, which can be set in an electronic device to store at least one instruction or at least one program related to implementing a communication method for an in-vehicle network. The at least one instruction or the at least one program is loaded and executed by the processor to implement any one of the communication methods for an in-vehicle network provided in the above method embodiments.
[0121] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store program codes.
[0122] It should be noted that the above-mentioned sequence of the embodiments of the present application is for description only and does not represent the advantages and disadvantages of the embodiments. The above-mentioned specific embodiments of this specification are described. Other embodiments are within the scope of the attached claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
[0123] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.
[0124] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.
[0125] The above are only preferred embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.
Claims
1. A communication method for an in-vehicle network, characterized in that: The method comprises: In response to a communication request of a current network device to a target vehicle network, collecting a physical characteristic of the current network device; Based on the current configuration state of the target vehicle network and the current network device, determining whether the communication request meets a preset communication authentication condition; In the case where the communication request meets the preset communication authentication condition, based on the authorized physical characteristics corresponding to the target vehicle network, the physical characteristics of the current network device are subjected to communication authentication to obtain an authentication result; the authentication result indicates whether the current network device is qualified to establish communication with the target vehicle network; The communication request is processed based on the authentication result.
2. The vehicle network communication method according to claim 1, characterized in that: The determining, based on the current configuration state of the target vehicle network and the current network device, whether the communication request meets a preset communication authentication condition includes: Obtaining the current configuration status of the target vehicle network; When the current configuration state indicates that the target vehicle network has a communication authentication mechanism enabled, determining whether the current network device meets the authentication-free condition; In a case where the current network device does not meet the authentication-free condition, it is determined that the communication request meets the preset communication authentication condition.
3. The vehicle network communication method according to claim 2, characterized in that: The method further comprises: Determining whether the current configuration state is an initial configuration state; the initial configuration state indicates that the target vehicle network closes a communication authentication mechanism; When the current configuration state is the initial configuration state, establishing a communication connection between the current network device and the target vehicle network; If the physical characteristics of the current network device do not exist in the authorized physical characteristics, adding the physical characteristics of the current network device to the authorized physical characteristics; The communication authentication mechanism of the target vehicle network is enabled, and the current configuration state is updated.
4. The vehicle network communication method according to claim 2, characterized in that: The method further comprises: When the current network device meets the authentication-free condition, a communication connection is established between the current network device and the target vehicle network.
5. The vehicle network communication method according to claim 1, characterized in that: The collecting of the physical characteristics of the current network device includes: Construct a parameter request frame for the target parameter; Sending the parameter request frame to the current network device, so that the current network device returns a response frame corresponding to the parameter request frame; Parsing the response frame to obtain the target parameter; A hash value is calculated based on the target parameter to obtain the physical characteristics of the current network device.
6. The vehicle network communication method according to claim 1, characterized in that: The processing of the communication request based on the authentication result includes: If the authentication result indicates that the current network device is not qualified to establish communication with the target vehicle network, rejecting the communication request; Sending alarm information to a network security node of the target vehicle network so that the network security node processes the alarm information.
7. A communication device for an in-vehicle network, characterized in that: The device comprises: A feature collection module, configured to collect physical features of the current network device in response to a communication request of the current network device for the target vehicle network; An authentication condition module, used to determine whether the communication request meets a preset communication authentication condition based on the current configuration state of the target vehicle network and the current network device; a communication authentication module, configured to perform communication authentication on the physical characteristics of the current network device based on the authorized physical characteristics corresponding to the target vehicle network, and obtain an authentication result when the communication request meets the preset communication authentication condition; the authentication result indicates whether the current network device is qualified to establish communication with the target vehicle network; A communication processing module is used to process the communication request based on the authentication result.
8. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the communication method of the vehicle network as described in any one of claims 1 to 6.
9. A computer-readable storage medium, wherein at least one instruction or at least one program is stored in the storage medium, and the at least one instruction or the at least one program is loaded and executed by a processor to implement the communication method of the vehicle network according to any one of claims 1 to 6.
10. A computer program, characterized in that When the computer program is executed by a processor, the communication method of the in-vehicle network according to any one of claims 1 to 6 is implemented.